VanishKeySponsored by KPT Industries

One link. One look.Then nothing.

Share passwords, API keys, and private notes with a one-time encrypted link. After one reveal, it's gone.

A carnivorous plant feeding a paper credential into a glowing VanishKey shredder
Fully encrypted • one-time access

What would you like to share?

Expires after 1 hour

● encrypted in your browser before upload

AES-256-GCM encryption One-time access Automatic deletion
Private by designSee how the disappearing act works
01

Create

Your browser encrypts the secret before upload. The decryption key stays in the complete link—not in VanishKey storage.

02

Share

Send the link however you prefer. Its reveal capability stays after the #, beyond ordinary link previews.

03

Gone

The recipient confirms reveal once. That retrieves and permanently deletes the encrypted copy. Unopened links expire after one hour.

Protocol v2

Under the hood.

The concrete controls behind the disappearing act—not a hand-wavy "military-grade" label.

AES-256-GCM Local authenticated encryption
Web Crypto generates a fresh 256-bit AES key and 96-bit IV for every secret. The random secret identifier is bound as authenticated additional data, so altered ciphertext fails authentication instead of producing corrupted plaintext.
256 + 256 Split reveal capability
Each link uses a 256-bit random lookup identifier and an independent 256-bit reveal token. The AES key and reveal token stay after the URL #; ordinary HTTP requests and link previews do not send that fragment.
TTL 3600 Ephemeral in-memory ciphertext
The live record contains only ciphertext and its IV in the in-memory secret store, created with a fixed one-hour TTL and collision protection. The AES key is never included in that record.
ATOMIC Single-use retrieval
The server stores a SHA-256 verifier for the independent reveal token. A valid reveal retrieves and deletes the record in one indivisible operation; the browser then authenticates and decrypts locally.

Security boundary: anyone holding the complete URL can reveal the secret. Direct email intentionally passes that URL through VanishKey and Mailgun. The AES key is never stored in the in-memory secret record.

Automation-friendly

Secrets for carbon and silicon.

Give people, AI agents, and automated workflows the same private way to share credentials without placing them in chat or logs. Our lightweight client encrypts locally and returns a single-use link.

Read agent.txt

Local encryption • no readable secret storage • one-time access

The same privacy model

Automation should not weaken encryption.

  • Encrypt locallyUnencrypted secrets are never stored.
  • Share onceEach complete link allows one confirmed reveal.
  • Delete automaticallyEncrypted data disappears after access or expiry.